The Wava Payment Plugin for WordPress has a critical vulnerability allowing unauthenticated attackers to overwrite merchant credentials. This issue affects versions 0.3.1 through 0.3.9 and is fixed in version 0.3.10. The vulnerability allows for potential unauthorized access and disruption of payment processing, emphasizing the need for immediate attention from site owners and security teams. The plugin's [truncated]
CVE-2026-87837 debrief based on the supplied source corpus. The CVE record was published on 2026-10-21T06:00:25.208Z and has not been modified since then. The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, allowing unauthenticated attackers to change the status of any WooCommerce order. This could potentially impact order pro [truncated]
